TL;DR

WP fail2ban can keep security events tied to the client whether WordPress receives the address directly or through a reverse proxy, load balancer, or CDN. If your hosting platform already presents the client address to WordPress, there is nothing else to configure.

When WordPress still sees the proxy address, WP fail2ban Free can recover the client from X-Forwarded-For, but only when the request came through a proxy you have chosen to trust. Premium keeps Cloudflare's published proxy ranges current automatically and adds persistent history for unexpected proxy activity.

Once the event contains the client address, you can use a fail2ban action that fits your network path—including an existing CDN integration that applies the ban at the edge.

Work with the network path you already have

WP fail2ban attaches the client address to login, comment, XML-RPC, WAF, and other security events. Most sites need no special handling: the web server or hosting platform gives WordPress the client address, and WP fail2ban uses it.

If WordPress receives a proxy address instead, WP fail2ban can recover the client before it writes the event. You can keep the reverse proxy, load balancer, or CDN your site already uses without losing the source that fail2ban needs.

Only one layer needs to restore the address. If your hosting stack already does it, leave WP fail2ban's proxy list empty. If WordPress still sees the proxy, let WP fail2ban do the job.

Accept forwarded addresses from trusted proxies

A client can add X-Forwarded-For to any request, so WP fail2ban does not accept the header on the client's word. It handles the three possible cases explicitly:

• With no proxies configured, it ignores the header.
• When the request came through a configured proxy, it uses the forwarded client address.
• When the header arrives from outside the configured trust boundary, it returns 403 Forbidden and writes an Untrusted X-Forwarded-For header hard-filter event.

A trusted proxy is allowed to say which client made every request. You decide which systems receive that authority.

WP fail2ban Free lets you define individual IPv4 or IPv6 addresses and full CIDR networks in wp-config.php. Its read-only settings UI shows the active configuration. Because the runtime mechanism uses the standard X-Forwarded-For header, it can work with any proxy or load balancer that supplies the client address that way.

Keep Cloudflare current automatically

Cloudflare's edge ranges change over time. You can add its published IPv4 and IPv6 ranges to the Free configuration yourself, but you then need to keep them current.

WP fail2ban Premium retrieves the ranges automatically each week. It recognises Cloudflare's edge as a trusted proxy and uses the client address Cloudflare supplies in X-Forwarded-For. Site Health warns you if the maintained list becomes stale.

Premium also records unexpected proxy activity with the originating IP in its event history, giving you the request history behind a hard-filter match.

Enforce the ban where traffic is controlled

WP fail2ban gives the event the client address. You can then choose the fail2ban action that matches the way traffic reaches your site.

An ordinary firewall action can enforce the ban where the client connects directly. When a CDN remains in front of the site, an integration such as Cloudflare's fail2ban action can apply it at the CDN edge instead.

The network path changes where the ban is applied, not what the WP fail2ban event means.